CVE-2021-28099: Insecure temporary file in Netflix OSS Hollow
Summary
CVE-2021-28099: Insecure temporary file in Netflix OSS Hollow. Affects com.netflix.hollow:hollow versions < 6.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netflix Hollow is an open-source project developed by Netflix. It is a Java library that provides a high-performance, low-latency, and memory-efficient way to consume large datasets. Hollow writes to a local temporary directory before validating the permissions on it.
Vulnerability Detail
The vulnerability in Netflix Hollow allows an attacker with the ability to create directories and set permissions on the local filesystem to pre-create a directory with wide permissions. This can lead to local information disclosure, as the attacker can read or modify anything written to that directory by the Hollow process. The issue arises from the fact that the existence of the parent directory is checked before creating the directories, and an insecure source of randomness is used for file names, making them deterministically calculable.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Netflix Hollow allows for local information disclosure, potentially leading to unauthorized access or modification of data. It is recommended to follow the provided steps to fix the vulnerability and avoid running Hollow in configurations that may expose it to less-trusted processes. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.netflix.hollow:hollow →
FAQ
Netflix Hollow is a Java library that provides a way to consume large datasets efficiently.
The vulnerability allows an attacker to read or modify data written by the Hollow process in a pre-created directory with wide permissions.
Avoid running Hollow in configurations that share a filesystem with less-trusted processes and wait for a future release that addresses the issue.
No specific workaround has been mentioned for this vulnerability.
The vulnerability was reported by security researcher @JLLeitschuh.
